CVE-2025-24391

Possible user enumeration

A vulnerability in the External Interface of OTRS allows conclusions to be drawn about the existence of user accounts through different HTTP response codes and messages. This enables an attacker to systematically identify valid email addresses. This issue affects: * OTRS 7.0.X * OTRS 8.0.X * OTRS 2023.X * OTRS 2024.X * OTRS 2025.X

We have discovered 1 live websites that are affected by CVE-2025-24391.

Run a Free Instant Scan



Affected Software

Product  OTRS
Category Issue Trackers
Vulnerable Domains1 live websites (1.04% of OTRS install base)
Vulnerable Versions
  • from 7 through 8
  • from 8 through 8
  • from 2023 through 2023
  • from 2024 through 2024
  • from 2025 through 2025.6.1
Vulnerable Versions Count0 versions ( less than 0.1% of all versions)


Common Weakness Enumeration

CWE-203 Observable Discrepancy



Details

  • Published - Jul 14, 2025
  • Updated - Jul 14, 2025

Credits

  • Special thanks to David Silva for reporting this vulnerability. (reporter)

Website Distribution by Country

Number of websites using CVE-2025-24391
Germany1 websites

Website Distribution by TLD

Number of websites using CVE-2025-24391
.com1 websites

Vulnerable Versions

Vulnerable versions are highlighted in red

Websites affected by CVE-2025-24391

Top websites that are affected by CVE-2025-24391. Please click on the "Contact us" link to get more information.
DomainCountryRankContacts
****.****.com Germany***,***,***
See full domain list

FAQ

CVE-2025-24391 is Observable Discrepancy in OTRS
A total of 1 websites have been identified as vulnerable to CVE-2025-24391, based on global website indexing conducted by WebTechSurvey.
The OTRS is affected by the CVE-2025-24391 vulnerability.
OTRS versions up to 2025.6.1 are vulnerable to CVE-2025-24391.
CVE-2025-24391 is resolved in version 2025.6.1 of OTRS.